R.1 Short title and commencement--

       (1) These rules may be called the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.
       (2) They shall come into force on the date of their publication in the Official Gazette.

R.2 Definitions.--

       (1) In these rules, unless the context otherwise requires,-
       (a) "Act" means the Information Technology Act, 2000 (21 of 2000);
       (b) 'Biometrics" means the technologies that measure and analyse human body characteristics, such as 'fingerprints', 'eye retinas and irises', 'voice patterns', 'facial patterns', 'hand measurements' and 'DNA' for authentication purposes;
       (c) "Body corporate" means the body corporate as defined in clause (i) of explanation to section 43A of the Act;
       (d) "Cyber incidents" means any real or suspected adverse event in relation to cyber security that violates an explicitly or implicitly applicable security policy resulting in unauthorised access, denial of service or disruption, unauthorised use of a computer resource for proces

R.3 Sensitive personal data or information.--

       Sensitive personal data or information of a person means such personal information which consists of information relating to;--
       (i) password;
       (ii) financial information such as Bank account or credit card or debit card or other payment instrument details;
       (iii) physical, physiological and mental health condition;
       (iv) sexual orientation;
       (v) medical records and history;
       (vi) Biometric information;
       (vii) any detail relating to the above clauses as provided to body corporate for providing service; and
       (viii) any of the information received under above clauses by body corpora

R.4 Body corporate to provide policy for privacy and disclosure of information.--

       The body corporate or any person who on behalf of body corporate collects, receives, posses, stores, deals or handle information of provider of information, shall provide a privacy policy for handling of or dealing in personal information including sensitive personal data or information and ensure that the same are available for view by such providers of information who has provided such information under lawful contract. Such policy shall be published on website of body corporate or any person on its behalf and shall provide for-
       (i) clear and easily accessible statements of its practices and policies;
       (ii) type of personal or sensitive personal data or information collected under rule 3;
       (iii) purpose of collection and usage of such information;
       (

R.5 Collection of information.--

       (1) Body corporate or any person on its behalf shall obtain consent in writing through letter or fax or email from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.
       (2) Body corporate or any person on its behalf shall not collect sensitive personal data or information unless --
       (a) the information is collected for a lawful purpose connected with a function or activity of the body corporate or any person on its behalf; and
       (b) the collection of the sensitive personal data or information is considered necessary for that purpose.
       (3) While collecting information directly from the person concerned, the body corporate or any person on its behalf shall take such steps as are, in th

R.6 Disclosure of information.--

       (1) Disclosure of sensitive personal data or information by body corporate to any third party shall require prior permission from the provider of such information, who has provided such information under lawful contract or otherwise, unless such disclosure has been agreed to in the contract between the body corporate and provider of information, or where the disclosure is necessary for compliance of a legal obligation:
       Provided that the information shall be shared, without obtaining prior consent from provider of information, with Government agencies mandated under the law to obtain information including sensitive personal data or information for the purpose of verification of identity, or for prevention, detection, investigation including cyber incidents, prosecution, and punishment of offences. The Government agency shall send a request in writing to the body corporate possessing

R.7 Transfer of information.--

       A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.

R.8 Reasonable Security Practices and Procedures.--

       (1) A body corporate or a person on its behalf shall be considered to have complied with reasonable security practices and procedures, if they have implemented such security practices and standards and have a comprehensive documented information security programme and information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business. In the event of an information security breach, the body corporate or a person on its behalf shall be required to demonstrate, as and when called upon to do so by the agency mandated/under the law, that they have implemented security control measures as per their documented information security programme and information security policies.
       (2) The international Standard IS/ISO/IEC 27001 on "Information Technolo